Esteban Ruiz

A use-after-free issue exists, which could lead to arbitrary code execution if successfully exploited. This allows attackers to execute arbitrary code.

The issue is an out-of-bounds write vulnerability that could lead to arbitrary code execution if successfully exploited. This vulnerability allows attackers to execute arbitrary code.

The issue is related to an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. This vulnerability affects the Adobe Acrobat and Reader products, allowing a remote attacker to execute arbitrary code due to a buffer overflow in memory.

The issue arises when the application processes project files, specifically due to a failure in checking references to freed memory. This can be exploited by an attacker using a specially crafted project file, potentially leading to the execution of code under the application's privileges.

The issue is related to an access of uninitialized pointer vulnerability when processing project files, which could lead to type confusion. An attacker could exploit this by using a specially crafted project file to execute code under the privileges of the application.

The issue allows an attacker to supply a pointer for a controlled memory address using a specially crafted project file. This may lead to remote code execution, data exfiltration, or cause a system crash.

The issue allows an attacker to inject commands that can delete files or the contents of a file through a specially crafted project file. This can potentially lead to arbitrary file deletion.

The issue allows execution of script code by opening a specially crafted report format file, which may lead to remote code execution, data exfiltration, or cause a system crash. Multiple vulnerabilities have been identified in the LAquis SCADA LGX Report, including path traversal, information disclosure, remote code execution, and arbitrary file creation.

The issue allows an attacker to execute remote code on the server due to improper sanitation of user input. This can be achieved through command injection vulnerabilities in various components of the LAquis SCADA Web Server, including the relatorioindividual TAG, acompanhamentotela TAGALTERE, acompanhamentotela PAGINA, and relatorioindividual TITULO.

The issue allows a user-supplied path in file operations prior to proper validation, which can be leveraged by an attacker to disclose sensitive information under the context of the web server process.

The issue allows an authentication bypass, which may enable an attacker to access sensitive data.

The issue allows code injection into a project file, which can be exploited by an attacker to execute code under the privileges of the application.

The issue allows for an out of bounds read when opening a specially crafted project file. This may cause a system crash or allow data exfiltration.

A type confusion issue exists when processing project files, allowing an attacker to use a specially crafted project file to exploit and execute code under the privileges of the application.

The issue allows the opening of a specially crafted report format file, which may cause an out of bounds read. This can lead to a system crash, allow data exfiltration, or enable remote code execution.

The issue allows an attacker to execute remote code on the server due to improper authorization or sanitation of user input. This can be achieved through command injection in certain parameters, such as `relatorionome TAG`, `relatorionome TITULO`, and `relatorionome NOME`.

The issue is related to the use of memory after it has been freed, which can be exploited by an attacker using a specially crafted project file to execute code under the privileges of the application. This vulnerability affects the Omron CX-Programmer development environment, used for programming and configuring Omron PLCs, and the CX-Server system, which ensures compatibility between Omron devices.

The issue allows an attacker to force the application to read a value outside of an array by tampering with the value of an offset when processing project files. This can lead to information disclosure.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the `Form count` property due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the `setElement` method due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process.